--- title: "Constant-time analysis: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/trailofbits-constant-time-analysis/ description: "Routes a timing review by language and says when not to use the analyzer." --- # Constant-time analysis: review, setup & limitations · Undominated.ai > Routes a timing review by language and says when not to use the analyzer. [← Explore all skills](/skills/) SECURITY REVIEW / Trail of Bits # Constant-time analysis Routes a timing review by language and says when not to use the analyzer. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/trailofbits/skills/tree/82fe8226252622fa807643bdca1710901198553a/plugins/constant-time-analysis/skills/constant-time-analysis) SOURCE REVIEW Reviewed 2026-10-14 Evidence 2 linked sources Publisher Trail of Bits Licence [CC-BY-SA-4.0 ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Revision 82fe82262526 [Read what was—and wasn’t—checked ↓](#review) “Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.” [Trail of Bits · upstream description ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The description names secret-dependent branches and division on secrets. - Headings include When NOT to Use and Language Routing. ### A good fit for - Reviewing cryptographic code for a timing leak - Refusing a constant-time claim that was not analysed - Triage dangerous emitted instructions against actual secret data dependencies ### Weigh up before choosing - CC-BY-SA-4.0 applies to an adaptation you redistribute. - No analyzer was run in this review. - The analyzer has no dataflow analysis; a flagged instruction is a candidate until secret dependence is traced. PASSED concerns error-level findings and can coexist with warnings. - Bytecode review cannot see later JIT transformations, and static instruction inspection does not cover cache side channels. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md - LICENSE ### Our findings - Headings include Interpreting Results. - The definition explicitly documents no-dataflow triage, warning-only detector families and configuration-specific results, plus optimized-away private Rust functions as a coverage caveat. - A finding that cannot be traced to a secret is not a finding and must be said explicitly rather than dropped. ### Not established by this review - The skill was not executed inside a host agent. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/README.md) DOCUMENTED COMMAND /plugin marketplace add trailofbits/skills Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Claude Code: add the marketplace with /plugin marketplace add trailofbits/skills, then install the constant-time-analysis plugin from /plugin menu. The plugin also carries the ct_analyzer package and a /ct-check command. - Codex: the README documents codex plugin marketplace add trailofbits/skills, then codex plugin add @trailofbits. - Install uv and the toolchain for each language you analyse. The SKILL.md prerequisites table lists them. ### Before you start - uv, and Python 3.10 or later for ct_analyzer (pyproject.toml) - The compiler or runtime for each target language - The cryptographic code under review ### Compatibility Claude Code plugin marketplace · Codex via Claude marketplace compatibility · C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python and Ruby ### Local Markdown instructions - Read the installed skill files - Read source and invoke compiler/disassembler tools to create local analysis artifacts; the documented analyzer does not execute the target. ### Cost model Source is free to read under the stated licence. A host agent may charge for use. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [Skill definition ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md) Checked 2026-10-14 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/plugins/constant-time-analysis/skills/constant-time-analysis/SKILL.md Supports: Workflow and stated scope - [Repository licence ↗](https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE) Checked 2026-10-07 https://github.com/trailofbits/skills/blob/82fe8226252622fa807643bdca1710901198553a/LICENSE Supports: Redistribution terms KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Project Wycheproof ↗ Loads Project Wycheproof vectors and maps valid, invalid, and acceptable results onto pass, fail, and warning, instead of treating a custom algorithm as in scope.](/skills/trailofbits-wycheproof/)[### Zeroize audit ↗ Looks for secrets that source claims to wipe but the compiler deleted.](/skills/trailofbits-zeroize-audit/)[### Algorand vulnerability scanner ↗ Pins Trail of Bits' Algorand scanner, which treats a short or empty coverage table as an unfinished scan and does not let a clean Tealer run stand in for patterns it never examined.](/skills/trailofbits-algorand-vulnerability-scanner/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)